morgan/FreeRDP
1
0
Fork 0
mirror of https://github.com/morgan9e/FreeRDP synced 2026-04-14 00:14:11 +09:00
Code Issues Packages Projects Releases Wiki Activity

[gdi,gfx] tighter bounds checks for gfx updates

Browse Source
This commit is contained in:
Armin Novak
2026-02-28 11:51:38 +01:00
parent ffad58fd2b
commit 41c9286c3c
1 changed files with 20 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
libfreerdp/gdi/gfx.c
View File

@@ -63,6 +63,14 @@ static BOOL is_within_surface(const gdiGfxSurface* surface, const RDPGFX_SURFACE
rect.left, rect.top, cmd->width, cmd->height, surface->width, surface->height);
return FALSE;
}
if (rect.left > surface->width)
return FALSE;
if (rect.right > surface->width)
return FALSE;
if (rect.top > surface->height)
return FALSE;
if (rect.bottom > surface->height)
return FALSE;
return TRUE;
}
@@ -434,6 +442,9 @@ static UINT gdi_SurfaceCommand_RemoteFX(rdpGdi* gdi, RdpgfxClientContext* contex
return ERROR_NOT_FOUND;
}
if (!is_within_surface(surface, cmd))
return ERROR_INVALID_DATA;
WINPR_ASSERT(surface->codecs);
rfx_context_set_pixel_format(surface->codecs->rfx, cmd->format);
region16_init(&invalidRegion);
@@ -492,6 +503,9 @@ static UINT gdi_SurfaceCommand_ClearCodec(rdpGdi* gdi, RdpgfxClientContext* cont
return ERROR_NOT_FOUND;
}
if (!is_within_surface(surface, cmd))
return ERROR_INVALID_DATA;
WINPR_ASSERT(surface->codecs);
rc = clear_decompress(surface->codecs->clear, cmd->data, cmd->length, cmd->width, cmd->height,
surface->data, surface->format, surface->scanline, cmd->left, cmd->top,
@@ -621,6 +635,9 @@ static UINT gdi_SurfaceCommand_AVC420(rdpGdi* gdi, RdpgfxClientContext* context,
if (!surface->h264)
return ERROR_NOT_SUPPORTED;
if (!is_within_surface(surface, cmd))
return ERROR_INVALID_DATA;
bs = (RDPGFX_AVC420_BITMAP_STREAM*)cmd->extra;
if (!bs)
@@ -707,6 +724,9 @@ static UINT gdi_SurfaceCommand_AVC444(rdpGdi* gdi, RdpgfxClientContext* context,
if (!surface->h264)
return ERROR_NOT_SUPPORTED;
if (!is_within_surface(surface, cmd))
return ERROR_INVALID_DATA;
bs = (RDPGFX_AVC444_BITMAP_STREAM*)cmd->extra;
if (!bs)